A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
  • BlackLaZoR@lemmy.worldEnglish
    1716·
    23 天前

    Expecting user to inspect install scripts is retarded. And this is the result.

    • GameEngineer@infosec.pubEnglish
      91·
      23 天前

      So what would the alternative be? If the resources or desire don’t exist to make a package official, how else would you install it?

      • BlackLaZoR@lemmy.worldEnglish
        46·
        23 天前

        You’re missing the point entirely. I’m talking about inspecting the scripts not about making packages

        • GameEngineer@infosec.pubEnglish
          142·
          23 天前

          Sorry if I was unclear. You usually don’t inspect the install scripts for official packages since you put the trust in the official team. You don’t trust(or at least shouldn’t) AUR packages, hence you should inspect the install script for those packages. I don’t really see what the alternative would be.

          • BlackLaZoR@lemmy.worldEnglish
            37·
            23 天前

            Well, the alternative would be for moderation team to inspect them, with clear signaling of which scripts are trusted and which aren’t.

            • Kazel@lemmy.dbzer0.comEnglish
              21·
              22 天前

              if you dufus can’t read a pkgbuild DON’T USE THE AUR might also keep the shell closed